WordPress Core Cross Site Scripting / SQL Injection

Description: SQL Injection via Links LIMIT clause Affected Versions: WordPress Core 6.0.2 Researcher: FVD CVE ID: Pending CVSS Score: 8.0 High CVSS Vector:CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Fully Patched Version: 6.0.2 The WordPress Link functionality, previously known as “Bookmarks”, i...

PYSEC-2022-43067

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate use...

(Pwn2Own) Softing Secure Integration Server Use of Default Credentials Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Softing Secure Integration Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the default configuration of user accounts. The configuration contains...

CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration so PHP is not possible if there is a frontend form available. This vulnerability was introduced i...

DEBIAN-CVE-2020-21365

Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations...

OESA-2022-1821 dnsmasq security update

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portabl...

The default installation configuration “[webserver] secret_key” of the Airflow data processing software’s creation, monitoring, and orchestration tools makes it possible for a malicious individual to gain unauthorized access to an external web server.

The vulnerability of the default installation configuration “webserver secretkey” in software for creating, monitoring, and orchestrating Airflow data processing scenarios is related to the use of pre-installed credentials. Exploiting this vulnerability could allow an attacker, operating remotely...

DEBIAN-CVE-2020-16093

In LemonLDAP::NG aka lemonldap-ng through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used...

UBUNTU-CVE-2020-16093

In LemonLDAP::NG aka lemonldap-ng through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used...

LemonLDAP::NG 信任管理问题漏洞

LemonLDAP::NG is a web single sign-on and access management software. A security vulnerability exists in LemonLDAP::NG version 2.0.8, which stems from a default failure to check the validity of X.509 certificates when connecting to a remote LDAP backend, due to the use of the default configuratio...

Mattermost Default Configuration Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a default configuration error that could be exploited by an attacker to bypass some existing rate limits or to use a manipulated IP for audit logging by manipulating the request header...

CVE-2022-2366

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a default configuration error that could be exploited by an attacker to bypass some existing rate limits or to use a manipulated IP for audit logging by manipulating the request header...

CVE-2022-2366 Incorrect defaults can cause attackers to bypass rate limitations

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers...

CVE-2022-2366 Incorrect defaults can cause attackers to bypass rate limitations

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers...

Atlassian Jira 8.20.x < 8.20.6 Cross-Site Request Forgery

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.18 or 8.20.x prior to 8.20.6. It is, therefore, affected by a vulnerability allowing authenticated remote attackers to restore the default configuration of fields via a...

Remote Code Execution (RCE)

php-horde-turba is vulnerable to remote code execution. The vulnerability exists due to a default configuration and can be exploited without knowledge of the configuration of the targeted Horde instance allowing an attacker to inject maliciously crafted script via a malicious email...

postgresql: memory disclosure in certain queries

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...

Liferay Portal and Liferay DXP insecure default configuration

Insecure default configuration in portal services implementation before 5.11.0 in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should ...

GHSA-R6J5-FQX9-7QV9 Mattermost Server SAML implementation does not require encryption or signature verification as default

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...